fix(tools): compile rss from immutable snapshots

Compile from_file against owned snapshot bytes materialized into a
private 0700 sandbox, cache and expose that digest on AgentRunner, and
publish the service cache only when the postcheck digest still matches.

Author: fffonion

README.md

@@ -58,7 +58,7 @@ placeholder route is advertised.
 | Observability (A9): bounded metrics registry, `GET /metrics`, structured terminal tracing | Implemented (see [docs/deployment.md](docs/deployment.md)) |
 | Provider protocol adapters (OpenAI Chat/Responses, Anthropic Messages, provider profiles) | **Partial — blocked by core (A3)**. Wire building, standard-shape guard, marker-preservation, and structured provider errors are green; buffered response parsing, streaming, and the Responses/Anthropic adapters stay typed `not_implemented` stubs until core compiler defects are fixed. See [plans/2026-08-13_a3-provider-core-blocker.md](plans/2026-08-13_a3-provider-core-blocker.md). |
 | RSS serial loop + durable compaction policies (A5) | Serial loop is wired into the library `AgentService` worker via bundled `rss/agent/main.rss`. Compaction policies remain implemented and tested (`rss/agent/compact.rss`). OpenAI-compatible buffered/streaming adapters stay A3-blocked; the gateway binary still runs `RUSTSCRIPT_AGENT_SCRIPT` and does not add an OpenAI-compatible inference path. See [plans/2026-08-13_a5-scope-split.md](plans/2026-08-13_a5-scope-split.md). |
-| Native coding tools + workspace-confined loop | Implemented for the library worker: `read_file`, `search_files`, `write_file`, `patch`, `terminal`, `process` run serially through the native registry. Local E2E: `cargo test --test coding_agent_e2e_tests` and `cargo test --test coding_agent_edge_e2e_tests`. See [docs/configuration.md](docs/configuration.md). Parallel tools remain excluded (A6). |
+| RSS coding tools + workspace-confined loop | Implemented for the library worker: `read_file`, `search_files`, `write_file`, `patch`, `terminal`, `process` run serially through `rss/tools/dispatch.rss`. Local E2E: `cargo test --test coding_agent_e2e_tests` and `cargo test --test coding_agent_edge_e2e_tests`. See [docs/configuration.md](docs/configuration.md). Parallel tools remain excluded (A6). |
 | Harness and approval machinery (A4) | Not implemented (excluded from the current milestone scope); approval **repository** CRUD exists, there is no approval flow driving runs |
 | Parallel tools and subagents (A6) | Not implemented (excluded from the current milestone scope) |
 | Scheduled / durable job execution | **Not implemented (explicitly excluded)**. Job CRUD, pause/resume, and latest-output routes exist, but there is no scheduler; `POST /api/jobs/{id}/run` is intentionally absent and answers `404`. |

docs/configuration.md

@@ -205,8 +205,8 @@ Built-in RSS registry tools, in registry order:
 | `search_files` | coding | read | Bounded workspace search. |
 | `write_file` | coding | write | Write complete workspace file contents. |
 | `patch` | coding | write | Minimal unique-string replacement. |
-| `terminal` | process | process | Direct `argv` execution; no shell command string. |
-| `process` | process | process | Background/control sibling of `terminal`. |
+| `terminal` | process | execute | Direct `argv` execution; no shell command string. |
+| `process` | process | execute | Background/control sibling of `terminal`. |
 
 Parallel tool calls are rejected (`unsupported_parallel`). Subagents and A6
 parallel fan-out are out of scope.
@@ -257,7 +257,7 @@ requests that are not retry-safe, lack a fingerprint, leak secret keys, or
 already have a later tool effect fail closed (`interrupted_provider`) with no
 provider or tool effect.
 
-Native dispatch is durable-first. Assistant `tool_call` parents and user
+RSS dispatch is durable-first. Assistant `tool_call` parents and user
 `tool_result` messages carry `parent_message_id` and monotonic `ordinal`
 values. A missing or name-mismatched parent fails closed (`missing_tool_parent`)
 and does not run the executor. Replaying an already durable `ToolResult` does

src/lib.rs

@@ -39,6 +39,7 @@ pub use runtime::rss_runner::{
     AgentConfig, AgentError, AgentRunner, MAX_AGENT_SOURCE_BYTES, RUN_EPOCH_CHECK_INTERVAL,
     RUN_EPOCH_DEADLINE_TICKS, Result, RunCancellation, RunDeliveryError, RunError, RunEventSink,
     RunnerPrepareFault, bundled_agent_main_path, bundled_tool_entries, bundled_tool_registry,
+    set_after_snapshot_hook,
 };
 pub use runtime::{
     AgentHostBridges, AgentProviderHost, ControlCheckHook, ScriptedProvider, agent_host_catalog,

src/runtime/mod.rs

@@ -11,5 +11,5 @@ pub use agent_host::{
 pub use rss_runner::{
     AgentConfig, AgentError, AgentRunner, MAX_AGENT_SOURCE_BYTES, RUN_EPOCH_CHECK_INTERVAL,
     RUN_EPOCH_DEADLINE_TICKS, Result, RunCancellation, RunDeliveryError, RunError, RunEventSink,
-    RunnerPrepareFault,
+    RunnerPrepareFault, set_after_snapshot_hook,
 };